Cyber SIEM Content Developer (TS/SCI) – Detect & Dashboards

IP Secure, LLC; Texas; On-site; USD 110,000 - 160,000; Full time

Benefits offered by this job

Medical

Dental

Vision

Unlimited Vacation

Sick Leave

Paid Federal Holidays

Education and Certification Reimburse-

401(k) retirement plan with match

Prepaid legal plan and ID protection

Accident Insurance

Critical Illness Insurance

Hospital Indemnity Insurance

Job summary

IPSecure, LLC is seeking a Cyber Content Developer / SIEM Engineer for JBSA Lackland, San Antonio, TX. You will implement use cases to provide analysts with a manageable SIEM view of security incidents and collaborate with leadership to align tasks with squadron requirements.

Your role includes creating detections, dashboards, and rules; optimizing SIEM performance; and developing content, tests, and documentation to support proactive security measures.

Qualifications

• Active TS/SCI clearance required.
• GMLE Certification within 120 days OR BS/MS in CS/Cyber Security.

Responsibilities

• Analyze DCO events and develop SIEM use cases.
• Create detections and alerts from log data across the enterprise.
• Develop dashboards and visualizations to identify adversarial activity.
• Tune and maintain SIEM rules to reduce false positives.
• Automate tasks in the SIEM using scripting languages.
• Prepare scheduled and ad-hoc reports with SIEM tools.
• Maintain SIEM documentation and resources.

Skills

Python

PowerShell

SOAR platforms

MITRE ATT&CK

Open-source security

Education

BS in Computer Science

MS in Computer Science/Cyber Security

Tools

Arcsight

Splunk

Devo

ELK

Phantom

Demisto

Job description

IPSecure, LLC is seeking a Cyber Content Developer / SIEM Engineer for JBSA Lackland, San Antonio, TX. You will implement use cases to provide analysts with a manageable SIEM view of security incidents and collaborate with leadership to align tasks with squadron requirements.

Your role includes creating detections, dashboards, and rules; optimizing SIEM performance; and developing content, tests, and documentation to support proactive security measures.